nicolabs/vegardit-docker-openldap
1
0
Fork 0
mirror of https://github.com/vegardit/docker-openldap.git synced 2026-05-21 12:14:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add ldap-password-reset group

Browse source
This commit is contained in:
sebthom 2023-05-15 19:50:04 +02:00
parent 6581afa328
commit a4891009b7
5 changed files with 19 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -42,6 +42,7 @@ ### <a name="initial-config"></a>Initial configuration
LDAP_INIT_ORG_DN='dc=example,dc=com'
LDAP_INIT_ORG_NAME='Example Corporation'
LDAP_INIT_ADMIN_GROUP_DN='cn=ldap-admins,ou=Groups,${LDAP_INIT_ORG_DN}'
LDAP_INIT_PASSWORD_RESET_GROUP_DN='cn=ldap-password-reset,ou=Groups,${LDAP_INIT_ORG_DN}' # users in this group can set password/sshPublicKey attribute of other users
LDAP_INIT_ROOT_USER_DN='uid=admin,${LDAP_INIT_ORG_DN}'
LDAP_INIT_ROOT_USER_PW='changeit'
LDAP_INIT_RFC2307BIS_SCHEMA=0 # 0=use NIS (RFC2307) schema, 1=use RFC2307bis schema

3
example/docker-compose/docker-compose.yml
View file

@ -14,7 +14,6 @@ services:
environment:
LDAP_INIT_ORG_DN: o=example.com
LDAP_INIT_ORG_NAME: Example Inc.
LDAP_INIT_ROOT_USER_DN: uid=admin,o=example.com
LDAP_INIT_ROOT_USER_PW: CHANGE@it
LDAP_BACKUP_TIME: # disable backup by setting to empty string
ports:
@ -43,7 +42,7 @@ services:
#LDAP connection https://ltb-project.org/documentation/self-service-password/1.3/config_ldap
LDAP_URL: ldap://ldap_service
LDAP_BASE_DN: ou=Users,o=example.com
LDAP_USER_DN: uid=ldapbind,ou=TechnicalAccounts,ou=Users,o=example.com
LDAP_USER_DN: uid=self-service-password,ou=TechnicalAccounts,ou=Users,o=example.com
LDAP_USER_PASSWORD: CHANGE@it
LDAP_FILTER: '(\&(objectClass=inetOrgPerson)(uid={login}))' # backslash is mandatory!
LDAP_LOGIN_ATTRIBUTE: 'uid'

19
example/docker-compose/ldifs/init_org_entries.ldif
View file

@ -42,19 +42,20 @@ sshPublicKey:
##############################
# Technical Accounts
##############################
dn: uid=ldapbind,ou=TechnicalAccounts,ou=Users,${LDAP_INIT_ORG_DN}
dn: uid=self-service-password,ou=TechnicalAccounts,ou=Users,${LDAP_INIT_ORG_DN}
ou: TechnicalAccounts
ou: Users
description: ldapbind user
description: Used by Self Service Password app to reset password/sshPublicKey attributes of other users
objectClass: top
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
uid: ldapbind
cn: ldapbind
sn: ldapbind
uid: self-service-password
cn: self-service-password
sn: self-service-password
userPassword: CHANGE@it
##############################
# Groups
##############################
@ -66,3 +67,11 @@ objectClass: groupOfUniqueNames
cn: ldap-admins
uniqueMember: uid=alice,ou=Employees,ou=Users,${LDAP_INIT_ORG_DN}
uniqueMember: uid=bob,ou=Employees,ou=Users,${LDAP_INIT_ORG_DN}
dn: cn=ldap-password-reset,ou=Groups,${LDAP_INIT_ORG_DN}
ou: Groups
description: Users that can set password and sshPublicKey attributes of other users
objectClass: top
objectClass: groupOfUniqueNames
cn: ldap-password-reset
uniqueMember: uid=self-service-password,ou=TechnicalAccounts,ou=Users,${LDAP_INIT_ORG_DN}

1
image/Dockerfile
View file

@ -88,6 +88,7 @@ ENV \
LDAP_INIT_ORG_DN='o=example.com' \
LDAP_INIT_ORG_NAME='Example Corporation' \
LDAP_INIT_ADMIN_GROUP_DN='cn=ldap-admins,ou=Groups,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_PASSWORD_RESET_GROUP_DN='cn=ldap-password-reset,ou=Groups,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_ROOT_USER_DN='uid=admin,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_ROOT_USER_PW='' \
LDAP_INIT_ALLOW_CONFIG_ACCESS='false' \

2
image/ldifs/init_mdb_acls.ldif
View file

@ -21,10 +21,12 @@ olcAccess: {1}to *
by anonymous auth
by * none
olcAccess: {2}to attrs=userPassword
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write
by self write
by anonymous auth
by * none
olcAccess: {3}to attrs=sshPublicKey
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_PASSWORD_RESET_GROUP_DN}" write
by self write
by users read
by * none